I know this is probably a bit of a nube question, but I need some input. So if I use last I can see my IP, and it's also in my auth log whether failed or accepted, eg.

Dec 9 19:30:16 wilhelm sshd[14211]: Failed password for root from 59.63.188.44 port 16257 ssh2

I want to know whether it is possible to only allow connections from IP's from a certain ISP. e.g. if I do whois X.X.X.X on my IP and grep for ISP:

root@wilhelm:~# whois X.X.X.X|grep <ISPNAME>
netname:        <ISPNAME>

So is it possible to add this to pam for SSH connections? Are there any disadvantages to this approach(except being locked out when in another location(portknocking maybe))? It's on a VPS so I'm not worried about internet dropping out. I can just use VNC if I absolutely have to. I have done a few quick searches on this and I'll continue to.

up vote 1 down vote accepted

Not exactly by PAM, but yes, it is possible to do. You can set this up using tcp_wrappers by modifying your /etc/hosts.allow, if your distro provides you the aclexec extension:

sshd: aclexec whois %a | grep <ISPNAME>

Or you can wrap the command into script that you can easily call.

More info can be found in manual page for hosts_options(5).

  • On the exit code of grep, which is 0 for the matched output and 1 for not-matched output. – Jakuje Dec 9 '15 at 20:16
  • Ah okay cool :) – Wilhelm Erasmus Dec 9 '15 at 20:21

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.